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Abstract — In this paper the Distributed Consensus and 
Synchronization problems with fuzzy-valued initial conditions 
are introduced, in order to obtain a shared estimation of the 
state of a system based on partial and distributed observations, 
in the case where such a state is affected by ambiguity 
and/or vagueness. The Discrete-Time Fuzzy Systems (DFS) are 
introduced as an extension of scalar fuzzy difference equations 
and some conditions for their stability and representation are 
provided. 

The proposed framework is then applied in the field of 
Critical Infrastructures; the consensus framework is used to 
represent a scenario where human operators, each able to 
observe directly the state of a given infrastructure (or of 
a given area considering vast and geographically dispersed 
infrastructures), reach an agreement on the overall situation, 
whose severity is expressed in a linguistic, fuzzy way; conversely 
synchronization is used to provide a distributed interdepen- 
dency estimation system, where an array of interdependency 
models is synchronized via partial observation. 

I. INTRODUCTION 

The mathematical modeling of real systems is generally 
subject to non trivial issues; in fact, in many cases, the 
phenomenon to be modeled is excessively complex, and the 
resulting model may either be a simplistic model or a too 
complex representation, which, in both cases, risks to be 
unsuitable for practical use. Indeterminacy and vagueness 
often arise as a consequence of our inability to exactly 
distinguish events in real situations; classical methodologies 
fail to cope with such vagueness. 

Notice that, if the nature of errors is random or proba- 
bilistic, then it is possible to adopt a stochastic framework; 
however if the underlying structure is not probabilistic, for 
instance due to subjective modeling choices, a different 
formalism is required. 

The role of indeterminacy and vagueness is particularly 
relevant when the system being modeled directly involves 
humans; for instance in the case where the state of the system 
represents a subjective preference or belief. 

In order to address such a problem and provide an ade- 
quate modeling tool, the fuzzy formalism appears the most 
natural choice. 

In the literature the synchronization of identical distributed 
systems has been widely investigated [12], [1], [23], [22]. 



Synchronization is intended as the convergence of the solu- 
tions of an array of identical systems to a common trajectory; 
the synchronization approach is said to be distributed if each 
system receives data only by a subset of the other systems 
(i.e. only from its neighborhood). When the trajectory is 
a stationary point (or a double integrator), the problem 
reduces to a consensus problem [10], [14]. However a 
framework able to handle the synchronization of systems 
in the presence of uncertain and vague values has not yet 
been introduced. Indeed uncertainty and vagueness is often 
present in many applicative contexts and, in particular, is 
necessarily introduced when human experts are involved. 
This is especially true in the field of Critical Infrastructures 
(CI) interdependency modeling, where models are often 
tuned by means of the information provided by human 
stakeholders and operators [8], [15], [20] or where, during 
crisis scenarios, human operators are in charge to estimate 
the effects of outages in widely dispersed and geographically 
distributed infrastructures. 



In order to address the distributed consensus and syn- 
chronization problems under uncertainty, in this paper the 
Discrete-Time Fuzzy Systems (DFS) are introduced and their 
stability is studied; moreover it is proven that, under rather 
general hypotheses, if the initial conditions of a crisp (i.e., 
non-fuzzy) system are fuzzyfied, then its stability properties 
are preserved. The distributed consensus and synchronization 
problem are then extended in the fuzzy fashion, considering 
fuzzy initial conditions. 



The paper is organized as follows: some preliminary 
definitions are collected in Section fTTl while the Discrete- 



time Fuzzy Systems are introduced in Section III Sections 



IV reviews the distributed consensus problem and its fuzzy 
extension, while Section and [V] reviews the distributed syn- 
chronization problem and its fuzzy extension; the application 
of such methodologies in the field of Critical Infrastructure 



Protection is discussed in Section VI providing also some 
simulative case studies; finally some conclusive remarks are 



discussed in Section VII while, in order to ease the reading, 
some proofs are collected in the Appendix. 



II. Preliminaries 

In the following, x will denote a vector with fuzzy entries, 
while crisp (i.e., non-fuzzy) vectors will be denoted by z. 

Let I p denote the p x p identity matrix and let c p be a 
vector of p components, each equal to c. 

Let A <E) B denote the Kronecker product of two square 
matrices A (n x n) and B (to x to), that is the nm x nm 
matrix: 

anB ■ ■ ■ a\ n B 



A®B = 



a n iB 



Q>7} .« B 



(1) 



Let R, N be the set of reals and integers, respectively and 
R + , N + be the set of nonnegative real and integer numbers, 
respectively. Let K£ be the space of nonempty compact 
convex subsets of R n . Let B n be the open unit ball in R n . 

Given a space X and a particular distance c?x defined over 
such a space, the Hausdorff separation and the Hausdorff 
metric for two sets 4,BcX are given by: 

p% x (A, B) = sup{d x (a, b):aeA,beB} (2) 
p d , x (A, B) = max{/4 x (A, B),p* diX (B, A)} (3) 

Consider the following discrete-time crisp (i.e., non-fuzzy) 
system: 



z(k + l) = G(z(k),k), z(0)=z 



(4) 



where k G N + represents the discrete time step, G : R" x 
N + — > R™ is continuous and z,zq & R n - 



Let 0,, 



[0,. 



, Or G R"; 0„ is a stable solution for 



System (|4]) if, for each e > there exists a positive function 
<5(e) such that 

d K ™(z , n ) < 6(e) implies d R „(z(fc),0„) < e,Vfc > (5) 
Moreover if further than <|5j it is also verified that 

lim dsn(z(k),0) = (6) 

k— v+oo 

then 0„ is said to be a asymptotically stable solution of Q. 

If a matrix M is non-negative (non-positive), i.e., it has 
only non-negative (non-positive) entries, write M > (M < 
0). If B — A is a nonnegative matrix, write B > A. 

Let gi(z(k),k) : R™ x N+ -> R be the z - i/i component 
of G(z(k),k) (i.e., G(z(k),k) is the column-wise concate- 
nation of the gi(z(k), k), for all i = 1, . . . n). 

Let z a ,z b G R"; define the partial orderings > as follows 



z a > z b 4=» z ai > z bi ,\fi = 1, . . 

x N H 



The definition of < is analogous 
A continuous function gi(z, k) : 1 
be monotone nondecreasing in z if: 



(7) 



is said to 



z a > z b => 9i{z a , k) > gi(z b , k) Vfc e N 
Conversely, it is monotone nonincreasing if: 

Za < Z b ff<(z , fc) < fc) 



Vz a ,Zf, G 



(8) 
(9) 



or in other terms if (?, (•, fc) preserves the partial ordering < 
(or>). 

The above definition can be easily extended to G(z, k) if 
it preserves the partial ordering < (>) defined in 

Notice that the monotone nondecreasing assumption for 
system Q is equivalent to require that the system is non- 
negative, that is, its state z(k) remains nonnegative for each 
k £ N + if the initial conditions zq are nonnegative. 

Let Q = {V,£,T} be a weighted graph with p nodes, 
where the set V denotes the nodes vi, . . . , v p ; £ is the set of 
edges (vi, Vj). Matrix T = {7^} is the weighted adjacency 
matrix describing the network topology; it is composed of 
non-negative entries and 7^ > ^ (i/j, Vj) € £ , i.e., there 
exists an arc that starts form node Vf and reaches node Vj, 
The value of 7^ represents the weight of the arc. 

The graph Q is said to be undirected if (vj,Vi) € £ 
whenever (vi,Vj) E £ (the weights are 7^ = 7.^ in this 
case); otherwise the graph Q is said to be directed. 

An undirected graph Q contains a spanning tree if there is 
a tree composed of a subset of the edges that connects each 
node vi to each node Vj \ in this case the undirected graph is 
said to be connected. A directed graph Q contains a directed 
spanning tree for a node Vj if there is a tree composed of a 
subset of the (oriented) edges that connects Vi to each other 
node vf, in this case the directed graph is said to be simply 
connected. 

A directed graph Q is strongly connected if for each couple 
of nodes and Vj there is a path composed of edges in £ 
that connects Vi and Vj, respecting the orientation of the 
edges. Clearly a connected undirected graph is also strongly 
connected. 

The set of the neighbors of a node Wj is denoted by Mi = 
{Vj G V : (oj, w,) G £}■ 

Let deg° u * = Y^=i Jij ^ e tne o«f-degree of node v$ (i.e., 
the number of outgoing links, weighted by the 7 coefficients) 
and let deg™ = X^=i Iji ^ e tne '"-degree of node Vi (i.e., 
the number of incoming links, again, weighted by the 7 
coefficients). Clearly, if the graph Q is undirected the in- 
degree and the out-degree coincide for each node. Generally 
speaking, if the in-degree equals the out-degree, the graph Q 
is said to be balanced. 

Let L be the Laplacian matrix induced by the adjacency 
matrix Y of a graph Q, whose elements {kj} are in the form: 



U 




(10) 



From this definition, it follows that L = D — Y, where 
D is a diagonal matrix containing the out-degrees of each 
node. Note that, by construction, L has zero row-sum, i.e., 
Yjj=i hj = for all i = 1, ... ,p. It is a well known result 
[10], [25] that the eigenvalues of L are all non-negative, A = 
being its smallest eigenvalue, whose multiplicity is equal 
to the number of connected components of the corresponding 
graph. Moreover if the graph is strongly connected, A = 
is a simple eigenvalue of L with eigenvector X p (i.e., Ll p = 
0). Moreover, if the graph is also balanced (or undirected), 



then l*L = (i.e., L has also zero column-sum). 
III. Discrete-Time Fuzzy Systems 




Fig. 1. Different a-levels of a triangular-shaped fuzzy membership 
function. In particular the support (a = 0) coincides with the base of 
the triangle (i.e., the interval of real numbers on the abscyssae between the 
two endpoints), while for a = 1, due to the particular shape considered, a 
single (i.e., crisp) value is obtained. 
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Fig. 2. The two triangular fuzzy numbers depicted represent the same 
value "about 4"; however the smaller one in blue is characterized by less 
uncertainty. 






Fig. 3. Examples of fuzzy numbers fx 6 E; many shapes are possible, 
although the Triangular Fuzzy Numbers (in blue) are the most used, because 
they can be described by the triple of the abscissae of their vertices ({4, 5, 7} 
in this case). More complex shapes, however, allow to characterize better 
the uncertainty; the leftmost Fuzzy Number (in black) represents a case 
where uncertainty rapidly decreases while approaching the central value; 
the rightmost Fuzzy Number, due to its trapezoidal shape, models the case 
where a single value with maximum belief can not be found. Notice further 
that the shape of a FN needs not to be symmetric, thus allowing to represents 
different beliefs on the left and right spread of uncertainty with respect to 
the value associated with the maximum belief. 



Let a fuzzy subset of R be defined in terms of a mem- 
bership function p : R —> (0, 1] which assigns to each point 



p £ R a grade of membership in the fuzzy set; such function 
is used to denote the corresponding fuzzy set. Let the p- 
membership p(p) be defined as the grade of membership of 
p £ R in the set /i. 

For each a £ [0, 1], the a-level set [p] a of a fuzzy set is 
the subset of points pel with membership grade p(p) > a. 
The support of a fuzzy set is defined as the closure of 
the union of all its a-level sets. 

Let E be the space of all fuzzy subsets p of R such that: 

1) fj, maps R onto [0, 1]; 

2) is a bounded subset of R; 

3) [p] a is a compact subset of R for all a £ (0, 1]; 

4) /j, is fuzzy convex, that is: fi(4>p + (1 — <j>)q) > 
min\p(p), fJ,(q)] for all p, q £ R 

the fuzzy sets of E are often called Fuzzy Numbers (FN). 
Indeed, as shown in figure ([TJ, the use of a-levels allows to 
address fuzzy numbers as a set of real intervals, as will be 
explained in Section |IH-B| 

A triangular fuzzy number (TFN) fj, £ E, in particular, 
is described by an ordered triple {p,i, p c , /i r } £ R 3 with 

Hi < Mc < Mr an d sucn tnat [A 1 ] = [fJ-h^r] an( J [lA 1 = {/"el, 
while in general the a-level set is given, for any a £ [0, 1] 
by: 

= [Mc-(l-a)(// c - m),n c + (l -a) (/x r -/x c )] (11) 

Figure Q shows two TFNs that represent the fuzzyfication 
of the same crisp (i.e., non-fuzzy) number 4; notice that 
the width of the base of the triangle is a measure of the 
uncertainty associated to the TFN. Triangular representation 
is not the sole available alternative; as depicted in Figure 
Q many other shapes are possible, and the more complex is 
the shape, the more descriptive is the resulting fuzzy number 
(i.e., the uncertainty is better characterized). For instance 
the existence of a plateau for a given interval represents 
complete indeterminacy for that interval, or, in the case of 
risk impact analysis, an asymmetry with respect to the peak 
may represents different beliefs for the best and worst cases. 

The space E is typically [6] equipped with the following 
metric 

d&(ji,v) = sup{p R (M Q >r)} p,v £E (12) 

The level-wise convergence (i.e., the convergence of the a- 
levels of the system) is defined as follows. Let {p n } be a 
sequence on E, then {/i„} converges level- wise to p, £ E if, 
for all a £ (0,1]: 



as 



(13) 



Define 



* = {p £ e : p{4> P + (i - <j>) q ) > Mp) + (i - 4>Mq)} 

(14) 

for each p,q £ \fi]°,(j> £ [0,1]. In [6] it is proved 
that convergence in (E. d^) implies level-wise convergence; 
moreover limiting to sequences in "J, the implication among 
convergence in (E, ds) and level-wise convergence can be 
revised. The following theorem extends the above result to 



TFNs. 

Theorem 3.1: Limiting to sequences in the set of TFNs, 
level-wise convergence implies convergence in (E, dg). 

Proof: See Appendix. ■ 

In order to consider vectors of N components, each being 
a FN, the space E w has to be characterized; to this end we 
chose to equip E N with the following metric: 



Theorem 3.2: Let a DFS system ( 20 » and let a crisp 



N 

d E »(x,y) = y^(h(xi,yi) 

i=l 



(15) 

T ,x,y£ E N . 



where x=[xi,..., x n ] T and y = [yi, . . . , y n 

Define the a-level of a vector of FNs v £ E^ as the set 
of vectors z £ R such that, Vi = 1, . . . , N Zi belongs to 
the a-level of i-th component 

Let {i/„} be a sequence on E^, then {f„} converges level- 
wise to v G E N if, for all a £ (0, 1]: 



Define 



PRN([u n ] a , [v] a ) ->• as n^oo 



V N = {v £ E N : Vi{<t>p + (1 - <j>)q) > 
>^ i (p) + (l-^)^(g),Vi=l,...,iV} 



(16) 



(17) 



for each p, q G € [0, 1]. Notice that, with the above 
definition of a-level of a vector of FNs, we have that 

lim p R «(K] Q , [v] a ) = ^ lim p R (K] Q , [Ui] a ) = 

n— >oo n—>oo 

(18) 

Vi = 1,...,N, therefore the scalar results on level-wise 
convergence are extended to the vectorial case. 

Define a Discrete-Time Fuzzy System (DFS) as follows: 

x(k+l) = F(x(k),k); x(0)=x o (19) 

where x, x £ E N and F £ F C [N+ x 

In the following Section the Stability of DFS will be 
addressed. 

A. Stability of DFS 

Let a DFS system in the form 

x(k+l) = F(x(k),k); x(0)=x o (20) 
where x, x £ E N and let a crisp system in the form 

z(k + l) = G(z(k),k), z(0) = z o (21) 

where z, z € R N and G € F C [N+ x R N ,R N ]. 

Analogously to the crisp case, let £ E N denote the trivial 
solution of Eq. ( f20) i, which we assume to exist. The trivial 
solution of System (20i is stable if, for each e > there 
exists a positive function 6(e) such that 

d E N [x , 6] < 6(e) implies d E N [x(k), 6] < e, Vfc > (22) 

If d E N [x(k), 0] — > 0, as k — >• +oo, then the trivial solution 
of System pO] ) is said to be asymptotically stable. 

Let us now discuss the solution of ( |20] > in terms of 
solutions of the crisp system (21 1, extending the results 
reported in [7], [6]. 



(21 1 where G(z(k),k) is a continuous function, monotone- 
nondecreasing with respect to z(k) for k > 0. 

Suppose that exists a continuous and positive valued 

defuzzyfication function V(x(k),k) : E N x N+ — > such 
that, posing z(0) = V(x(0),0), for each k > 



V(x(k + 1), k + 1) < G(F(x(fe), jfe), jfe) 



(23) 



Suppose further that there exists a continuous, monotone 
non-decreasing function a(-) defined in M — > M + such that 



a(d E »[x(A:),0]) < V (x(k),k) 



(24) 



where d E w is the distance in E defined in (15i and 
Vo(x(k),k) is defined as 



N 

V {x{k) t k)=^2Vi{x(k),k), Vfc>0 (25) 
Then the stability properties of the trivial solution of 



Eq.(21i imply the corresponding stability properties of the 
trivial solution of Eq.([20|. 

Proof: See Appendix. ■ 

The above comparison theorem is very useful, since the 
stability of fuzzy systems can be derived from the stability 
of a non-fuzzy system. The following Corollary provides a 
useful parallelism between the stability of a fuzzy system and 
the stability of a crisp system obtained by defuzzyfication 
(i.e., the case in which G(z(k),k) = F(z(k), k)). 

Corollary 3.3: Let a DFS in the form of Eq. ( |20| and let 
the following crisp systems 



z(k + l) = F(z(k),k) z(0) = V(s(0),0) 



(26) 



such that F(z, k) is monotone nondecreasing in z for each 
k £ N + ; then the stability properties of crisp system p6[ ) 
imply the corresponding stability properties of the DFS ( |20| i. 
Proof: See Appendix. ■ 

B. Levelwise Representation 

Each state variable Xi is such that, at any time k its a-level 
is given by 

[ Xi (k)] a = [xf(k),xf(k)}, Vi=l,...,JV (27) 

In [11], [21], [5], it is shown that, for each time k and for 
each a-level , the evolution of the system can be described 
by 2N crisp difference equations for the endpoints of the 



intervals of eq. (27 1. 

In the linear and stationary case where F(x, k) = Fx, 
(i.e., F is a N x N matrix), matrix F is decomposed into a 
monotone nondecreasing F + and a monotone nonincreasing 
F~ . The evolution for each a-level is given by 



(28) 



Indeed, under the monotonicity assumption it follows that 
F + = F and F" = 0; therefore the stability of System ((28]) 



~x a (k + 1) 




~F+ 


F~~ 




'x a (k)~ 


x a (k + l) 




F~ 


F+ 




x a (k) 



is assured by the stability of the crisp system z(k + 1) = 
Fz(k), i.e., the above stacked system is composed of two 
isolated replica of the original model. 

Dropping monotonicity assumption (>), however, F~ ^ 

0. 

I -I 



Let the transform matrix T 



I I 



changing coor- 



dinates by means of this transformation we have that 



T 



F 
F~ 



F~ 



T -i = 



F+ - F~ 








F- 



F\ 
F 
(29)" 

Since the transformed matrix is block diagonal, the stability, 
for each a-level is obtained if both F and |F| are stable in 
the discrete-time sense or, in other terms, the stability of the 
absolute valued dynamic crisp system is required to assure 
the stability of the fuzzy system. 

IV. Consensus 

Let Q = {V,£ , r} be a graph with p nodes, and assume 
without loss of generality that the graph has unitary weights. 

Let us consider without loss of generality the scalar 
consensus, and let Zi £ K be the state variable associated 
to the z-th node. 

Nodes i and j are said to agree if Z{ — Zj and consequently 
the graph Q agrees if each couple of nodes Vi and Vj agrees, 
for all Vi, Vj £ V. Whenever all the nodes of a network are 
in agreement, the common value of all nodes is called the 
group decision value. 

Let each node in the network be modeled as a discrete- 
time dynamic agent, whose dynamics is in the form: 



Zi(k + 1) = g(zi(k), ei(k)), Zj(0) = z i0 



(30) 



where ej(fe) £ K represents the input for i-th agent and 
Zio is the initial condition vector for i-th agent. The stacked 
dynamics for all the p agents is given by: 

z(k + l)=G(z(k),e(k)) z(0)= [zi(O),--- ,z p (0)] T 

(31) 

where z,e £ M. p are stack vectors composed of the 
state variables and inputs of each agent, respectively, 
i.e., z — \z\ ■ ■ ■ Zp] and e = [ei • • • e p ] ; 
G{z{k),e{k)) is the column-wise concatenation of the el- 
ements g(zi(k),ei(k)). 

Let a function x : R p — > M; the X' consensus problem can 
be interpreted as a distributed way to calculate x(z(0)) by 
using as inputs for each node only information depending on 
the values of its neighbors Mi. 

Define a protocol, i.e., 



e i{k) — fi{ z j! {k), ■ ■ ■ , Zjrrii {k)) 



(32) 



with ji,.-.,j mi £ Mi U {i} and, obviously, < p. A 
protocol asymptotically solves the x- consensus problem if 
and only if there exists an asymptotically stable equilibrium 
z* of pT} such that for each node z* = x( z (0)) for all 
i g [l,p\. 

In the literature different typologies of consensus have 
been addressed; in the following we will review the average 



consensus problem for networks of discrete-time single and 
double integrators. 

A. Single Integrators 

Consider a network composed of p dynamic agents, each 
one described by an integrator [10]: 



Zi(t) = ei{t), Zi(0) = z i0 Vi>i € V 



(33) 



where z% £ M, e, € K. In the discrete-time fashion the system 
becomes: 

Zi(k + 1) = Zi(k) + T6i(k), Zi(0) = z M Vv t € V (34) 

where r > represents the sampling time. In [10] the 
following protocol is used to solve the continuous-time 
average consensus problem: 



(35) 



where ay are the coefficients of the adjacency matrix of the 
considered graph. The resulting stacked dynamic system for 
the p agents is given by 



z(t) = ~Lz(t), z(0) = z 



(36) 



where z £ W and L is the graph Laplacian induced by T. 

In [18] it is proved that, if the graph Q is simply connected 
(i.e., contains at least a directed spanning tree) a consensus 
equal to a linear combination of the initial conditions of the 
agents is reached, while the consensus coincides with the 
actual average of the initial conditions if the graph is strongly 
connected and balanced. 

When the protocol is applied in the discrete-time fashion, 
the resulting stacked dynamics is in the form: 

z{k + 1) = P T z{k) (37) 

where P T = I p — tL is called the Perron matrix [10]. 

The following Lemma [10] provides a stability condition 
for the discrete time first order average consensus problem. 

Lemma 4.1: Let t± = l/l*; then choosing r < r*, 



protocol ( 35 i solves the consensus problem for a network of 



discrete-time single integrator agents if the graph Q contains 
at least a directed spanning tree. If the graph Q is also 
strongly connected and balanced, then the average consensus 
is achieved. 

Notice that, as illustrated in the following, the condition 
on the sampling rate r < t{ is a sufficient and conservative 
estimation of the maximum sampling rate that guarantees the 
convergence of the consensus problem. 

B. Double Integrators 

Consider a network composed of p dynamic agents, each 
one described by a double integrator [17], [16], [9]: 

Zi{t) = ei(t), ii(0) = Zio, Zi(0) = Zio, Vuj G V (38) 

where Zi £ K and £ M. 



In [9] the protocol used to solve the continuous-time 
average consensus problem is: 

e i(*) = EjeAT, a ij[zi{t) - Zi(t)] + EieM ^jfoW ~ %(<)] 

(39) 

Defining z a — z G W and z;, = i <E R p , the resulting 
dynamic for the p agents can be posed in the form 



Z a (t) = Z b (t) 

z b (t) = -Lz a (t)-z b (t)+e(t) 



(40) 



where z o (0) = z = [^,--- and z t (0) = i = 

[if, • • • . 

In order to obtain a discrete-time representation of an agent 
described by a double integrator, in [19], [2] the above model 
is sampled with sample time r, and the following protocol 
is adopted 

= EjgJVi a y - Zoj (&))] + 

(41) 

+ EjeM a « i z bi{k) ~ z bj{k))\ 
providing a condition for the stability of the resulting system. 

In this paper, however, we will adopt a simpler formula- 
tion, considering two inputs e a i and eu- Hence the model of 
the i-th agent, in the proposed formulation, becomes: 



I z ai {t) = z bi (t) + e ai (t) 

\zu{t) = 66,* (*) 

and consequently its discretization with sample time r is 

\ z ai (k + 1) = z al (k) + Tz bi (k) + Te ai (k) 
} z bi (k + 1) = z bl (k) + Te bi (k) 



(42) 



(43) 



Theorem 4.2: Let p systems in the form of Eq. (43 1, such 
that their graph Q contains at least a directed spanning tree. 
Then if r < h the agents reach a consensus using the 
protocol 



Sai{k) — EjeAA; a ij[( z ai z aj)] 
eu{k) = EieM a iA( Z bi ~ Zbj)} 



(44) 



Moreover if the graph Q is also strongly connected and 
balanced, then the consensus reaches the average of the initial 
conditions. 

Proof: The overall dynamic for the p systems, consid- 



ering the protocol ( 44 1 becomes 

I -tL 




'*„(* + 1)" 




z b (k + l)_ 





tI 

I -tL 





Za{k) 




_z b {k)_ 



(45) 



Note that, in this formulation, the dynamics of z b is decou- 
pled from z a , and has the standard form of a single integrator 
system. Therefore an agreement on z b is reached if r < l/l*. 
Since the dynamic matrix is block triangular, the condition 
t < l/l* is sufficient for the stability and the consensus is 
reached asymptotically. And from Lemma ( |4.1| i if Q contains 
at least a directed spanning tree a consensus is reached, while 
if the graph is strongly connected and balanced, the average 
consensus is reached. 



Note that, in this case the average consensus is an agree- 
ment on the "velocity" which becomes constant, while the 
"position", although being asymptotically the same for all 
the agents, varies with constant velocity. 

Note that also in this case the condition on the maximum 
value of the sampling rate has to be considered as a conser- 
vative estimation. 

C. Fuzzy Consensus 

In this Section a framework for the discrete-time first order 
and second order average consensus problem with fuzzy 
initial condition is provided extending the results for crisp 
systems [10]. Let a graph Q composed of p agents, where 
the dynamics of each agent is described by the DFS 



Xi(k + 1) = F(x i (k),e l (k)) 1 3^(0) = x i0 



(46) 



Where a;,, x^, € E q depends only on the state of agent 
i and his neighbors Ni, according to the topology described 
by the matrix T. The array of fuzzy agents reaches consensus 
if 



lim dwi[xi(k), Xj(k)] — 0, = 1, 



,P 



(47) 



where ds* is the metric defined in Eq. (15l. 

Conversely, the array of fuzzy agents reaches consensus 
level-wise if, for all a € [0, 1] and Vi = 1, . . . ,p: 



lim p dl , qMq (xf(k),xf(k)) =0 



(48) 



The following result correlates consensus and level-wise 
consensus of fuzzy systems: 

Proposition 4.3: The consensus of fuzzy agents in the 



sense of (47i implies level-wise consensus (48 I. 

Proof: The proof of such a statement trivially derives 
from the definition of ■ 
Note that, limiting each state variable to the set "5, defined 



in Eq. ( 17 1, the implication can be reversed; hence this is true 
for systems with initial conditions described by TFNs. 

The following theorem correlates the crisp and fuzzy 
consensus in the case of single and double integrators. 
To avoid confusion the following notation for the fuzzy 
extension of single and double discrete-time integrators will 
be adopted, considering the state arranged by type: yi (or 
[yi,Vi] T ) will denote the state of the i-th single (or double) 
integrator; y (or [y, v] T ) will denote the stack array composed 
of the state variables of all the p agents of the whole system. 
The consensus value reached by i-th agent (which, obviously, 
assumes the same value for each agent) is denoted by y* (or 
). We will also consider the vector of the consensus 



„*1T 



,*1T 



[y* 

states for the array of agents, denoted by y* (or [y* 
). Note that in the case of the double integrators the agents 
reach a constant value for v* (e.g., constant velocity), while 
y* , although shared by the agents, changes (e.g., position); 
in this case, then, we will denote the consensus reached at 
k-th step as [y*(k),v*]. 

Theorem 4.4: Consider a fuzzy consensus problem with 
p interconnected discrete time agents with fuzzy dynamic 



described by Eq. ( |46) i, where the graph Q contains at least a 
directed spanning tree. Then both the following statements 
hold true: 

1) if the dynamic of each agent is a discrete-time single 



integrator in the form of Eq. (041, protocol ( 35 i solves 



the problem for r < I /I* and the agents reach an 
agreement; 

2) if the dynamic of each agent is a discrete-time double 



integrator in the form of Eq. (43 I, protocol (44 1 solves 
the problem for r < 4 and the agents reach an 
agreement. 

Moreover if the graph Q is also strongly connected and 
balanced, the average consensus is achieved. 

Proof: From Lemma |4~T| system ( |34| > reaches consensus 
for t < l/l*; moreover the overall dynamic matrix has only 
nonnegative entries and is monotone nondecreasing. Hence 



by Theorem 3.3 it follows that system (34i reaches consensus 



also in the fuzzy fashion. Analogously, by Theorem 4.2 



system ( |45| ) reaches consensus in the fuzzy fashion for r < 
h. The same considerations apply for average consensus. ■ 
Corollary 4.5: Let r be a vector in M. p , with J2j=i r j = 1 
and rj > for each j = 1, . . . ,p. Under the hypotheses of 



Theorem (5.4i assuming that T contains at least a directed 
spanning tree, then the following statements hold true for 
each a-level: 

1) in the case of discrete-time single integrators 



2) in the case of discrete-time double integrators 



(49) 



{yr a (k) 



krv* a 
krv* a 



(50) 



for each i = 1, . 
Proof: Let R = 



• P 



. , r] T be a p x p matrix. From 
Theorem 5.4 it follows that the array of single integrators 
reach consensus. The value reached is given by x* = Rx$. 
Since R has only non-negative entires, for each a-level the 
consensus reached assumes the structure of Eq. ( |28| , where 
R + = R and R~ = 0, proving statement 1. The proof for 
v* in the case of double integrator is analogous, since the 
evolution of v coincides with the evolution of y in the case 
of single integrator (i.e., v does not depend on y). For what 
concerns y* we have that: 

y(k + 1) = P T y(k) + rv[k) = y a (k + 1) + y\k + 1) (51) 

Since the system is linear, the effects of the two terms y a 
and y b can be evaluated separately: 



y a *(k) = Ry 
y b *(k) = k T Ry 



(52) 
(53) 



Analogously to previous statement, using the level-wise 



Corollary 4.6: For a = 1 fuzzy consensus coincides with 
crisp consensus for both single and double integrators. 

Proof: For a = 1 it follows that ^(O) = ^(O) (i.e., 
the interval collapses into a single point). Substituting inside 
system (|49|), it follows that y 1 (k) = y 1 ^), for all k > 0. 



The proofis analogous in the case of double integrators. ■ 

V. Synchronization 

In the literature the synchronization of identical distributed 
systems has been widely investigated [12], [25], [1], [23], 
[22]. Synchronization is intended as the convergence of the 
solutions of an array of identical systems to a common 
trajectory; the synchronization approach is said to be dis- 
tributed if each system receives data only from a subset of 
the other systems (i.e., only from its neighborhood). When 
the trajectory is a stationary point, the problem reduces to a 
consensus problem [10], [14]. However a framework able 
to handle the synchronization of systems in the presence 
of uncertain and vague values has not yet been introduced. 
Indeed uncertainty and vagueness are often present in many 
applicative contexts, in particular when human experts are 
involved. This is especially true in the field of Critical Infras- 
tructures (CI) interdependency modeling, where models are 
often tuned by means of the information provided by human 
stakeholders and operators [20], [8], [15] or where, during 
crisis scenarios, human operators are in charge to estimate 
the effects of outages in widely dispersed and geographically 
distributed infrastructures. 

Let p identical linear systems, where the i-th system is in 
the form: 



Zi(k + 1) = Az t (k) + Ui(k) 
[y(k) = Cz(k) 



(54) 



with A G M. nxn , C G M mx " and m < n, z t , Ul G E™, and 
consider the case in which the only information available for 
each system is given by 



e<(&) = ELi iij(yj( k ) - ydk)); 



(55) 



where the coefficients 7^ allow i-th system to communicate 
only with its neighbors, according to the p x p adjacency 
matrix T. Set u.i(k) = flei(k); in other terms 



i(fc) = nc£Li7«(*i(fc)-*(fc)); 



(56) 



where ft is an n x m matrix. 



representation of Eq. ( 28 1, the statement is proved. 



The above systems in the form of Eq. (54i are said to 
synchronize if 

limfe_j. + oo \\zi{k) - Zj(k)\\ = ; Vi, j = 1, . . . ,p; i^j 

(57) 

i.e., if all the n components of the different p systems assume 
homologous values. 

Let us now provide a single equation that summarizes the 
dynamics of the considered p systems (|54]i. Note that, using 
the input (|56]l, the dynamics of the single system is given 



by: 



p 



Zi(k + l) = Az i (k) + nC}^i ij (z j (k)-z i (k)) (58) 

i=i 

Note further that in the above equation the state Zi of 
the i-th system depends on the states Zj of the other 
systems, according to the topology defined by T. Let z(k) = 
[zi(k) T , . . . , z p (k) T ] T be a stack vector containing the states 
of all the p systems; the overall dynamics will be in the form 
z(k + l) = Az(k), where A is a npx np matrix summarizing 
the dynamics of the p agents, i.e.: 

z(k + l) = Az(k) = [I® A- L®QC]z(k) (59) 

in fact the terms Azi(k) in Eq. ( |58| ) are dependent only on 
Zi(k) and therefore the stacked matrix contains a term 



I ® A = 



A 



A 



For the second part of matrix A, note that in the summation 
of Eq. ([58]), the term —Zi(k) appears 53f=i7« = hi times, 
while exactly la neighbors Zj(k) are considered; therefore 
the term fiC has to be pre-multiplied (in the kronecker 
sense), by — L, where L is the Laplacian matrix. 

It is immediate to recognize that the p systems (54i 



synchronize if the stacked system (59i is stable. Hence the 
synchronization of p identical systems can be granted by 
choosing a "control" matrix £1 that stabilizes the closed loop 



system ( 59 1. Note that the stability of the single systems does 
not guarantee by itself the synchronization of the trajectories 
of the different systems. 

In [25] a Lyapunov-based approach is adopted to grant the 
stability and then the synchronization, but it requires some 
hypotheses on all the eigenvalues of matrix L. On the other 
hand in [22], under the hypothesis of a stable matrix A and 
observable pair (A, C), a sophisticated algorithm is used for 
the choice of matrix fi. The following theorem proves that, 
under some additional hypotheses, such as the positivity of 
the systems, the complexity of choosing ft can be greatly 
reduced. 



Theorem 5.1: Suppose that matrix A is such that: Vi, j 



1, 



, n an > and for all i — 1, 



following structure: 

'A ~ luK 

l P iK 



- X K A- 



K 



(62) 



From Gershgorin Circle Theorem [24] the eigenvalues of an 
n x n matrix M lie, in the complex plane, in the union of 
circles centered in x(*) = m u with radius equal to p(i) = 
Y^j—i-jjti \ m ij\- Since C T C is non-singular, it is possible to 
set ft — KC^; in this case, focusing on the i-th row of the 
q-th block row; the center is given by 



7gg 



k'ii CLii Iqqka 



(63) 



By Condition (61 



it follows that < %(<?, i) < 1. The off 
diagonal elements for row i of block row q are all positive, 
hence the | • | is not required for the radius, which is given 
by: 

(64) 



Since x(g, i) > 0, the system is stable in the discrete-time 
sense if x(q, i) + p(l, < 1 for each q = l,...p and i = 
1, . . . , n, or in other terms if Y^j=i a ij — 1' which is verified 
from the hypotheses. ■ 

Such a positivity assumption is in many cases justified; 
for instance, as will be shown in the case study, the class 
of interdependency models for critical infrastructures, where 
the percentage of malfunctioning (or inoperability) is intrin- 
sically positive if no recovery action is considered. 

Notice that, if C T C is non-singular, in order to obtain the 
desired diagonal matrix K it is sufficient to set ft — KC\ 
where = (C T C) _1 C T is the left pseudo-inverse of C. 

In [22] it is proved that, for a connected topology, the p 
systems converge to the following shared state value: 



z*(k) = (A k ®r T ) 



(65) 



(60) 



a » - 1 

and suppose that C T C is non-singular. Let K — VlC. If it 
is possible to find il such that K is diagonal and 

0<fcii<^, Vi=l,...n (61) 

'"m 

where l m is the minimum diagonal element of the Laplacian 3 = 1 >---,P, proving the statement. 



where r € M. p is a vector such that r T L = and Ylh=i rh ~ 
1. 

It is possible to specify some conditions, in order to further 
characterize the synchronization reached. 

Corollary 5.2: If the graph is strongly connected and 
balanced, then the p systems synchronize to the average 
evolution. 

a) Proof: Since systems synchronize, it follows that 
r T L = and r T l p = 1 (66) 
Moreover, a balanced graph ensures that LjL = 0. Therefore 



the only r that satisfies (|66|l is such that r.j = i for each 



matrix induced by the adjacency matrix T; then System (59 1 



is stable and the array of systems (54i synchronize 



Proof: The dynamic matrix of System ( 59 1 has the 



Note that it is also possible to obtain the synchronization 
to a weighted average or to the sum of the evolutions. It is 
sufficient to use the synchronization algorithm with modified 



initial conditions z m obtained from the real initial condition 
detected ZiQ. For example if Zio — pz^ for each system i, the 
sum of the evolutions is obtained. Note that, to achieve this 
result, each system needs to know the number of systems 
involved in the synchronization. 

A. Synchronization of Fuzzy Systems 

Let us now discuss the synchronization of linear and sta- 
tionary DFS systems with partial state coupling is provided, 
extending the results for crisp systems [22]. Let an array of p 
DFS, each with n state variables; the state of the z-th system 
is denoted by Xi £ E™, while the j-th component of the z-th 
system is denoted by Xij £ E. 

The array of p identical DFS synchronizes if 

Urn d M »[xi(k),Xj(k)) = 0, Vi,j = l,...,p (67) 

k— >oo 

The array of identical DFS synchronizes level-wise if, for all 
6(0,1]: 



limfe^oopJjQiEyJ^fc), [x iq ] a (k)) = 
Mj,q = l,...,n, and Vi = 



(68) 



The following proposition correlates synchronization and 
level-wise synchronization: 

Proposition 5.3: The synchronization of an array of iden- 
tical DFS implies their level-wise synchronization 

b) Proof: This fact derives from the definition of d&. 

Note that, limiting each state variable to the set '5, defined 
in Eq. (17 1, the implication can be revised; according to 
this is true for linear systems with initial 



Theorem 3.1 



conditions described by triangular fuzzy numbers. 

The following theorem correlates the synchronization of 
an array of linear and stationary crisp systems with the 
synchronization reached by the same systems in the fuzzy 
fashion. 

Theorem 5.4: Let the conditions required by Theore m |5.1| 
hold for an array of p crisp systems in the form of Eq.(|54[>, 
where ft is chosen according to Theorem |5.1| then the array 
of DFS, where each systems has the same dynamics of (54i 
and fuzzy initial condition, synchronize in the sense specified 
by (J67J. 

c) Proof: From Theorem 5.1 it follows that the crisp 
overall stacked system ( |59| ) is stable and the array of p 
systems synchronize. Since is such that [A ® I — L ® Ktt] 
has only nonnegative entries, it follows that the condition 
required by Theorem 3.3 is verified, and the theorem is 
proved. 

The following corollary provides a characterization of the 
synchronized evolution: 

Corollary 5.5: For each a-level the synchronized evolu- 
tion is given by: 



x a *(k) 



•A k ] 



A k 



cf(0) 



S»(0) 
(69) 



d) Proof: Eq. ( 65 1 can be restated for the stacked 
systems as 

z* = (R®H)z (70) 

r*]T 



where R 



1, 



j-p yy T, Z — „ pl 

represents the synchronized evolution, and are all the same) 
and z Q = [zi(0), . . . ,z p (0)] T . 

Since crisp and fuzzy systems are linear, when switching 
to the fuzzy variables, above equation becomes x* = (R ® 
H)x . 



\Y (note that z* 



Furthermore, by Theorem 5.3 we have that the array of 
fuzzy systems synchronize levelwise; therefore, for each a- 
level, the synchronized evolution becomes: 

~R®(A+) k R®(A-) k ~ 
R®(A-) k R®(A+) k 



~x a *(k) 




x a *(k) 







~x a (0) 




x a {0) 



(71) 



since the stacked dynamic matrix has nonnegative entries it 
follows that A~ — and the theorem is proved. 

Corollary 5.6: Crisp synchronization coincides with 
fuzzy level- wise synchronization for a = 1. 

e) Proof: For a = 1 it follows that x 1 (0) = 5 1 (0) 
(i.e. the interval collapses into a single point). Substituting 
inside Eq. (|69]l, it follows that ^(k) = ^(k), for all k > 0, 
proving the statement. 

Note that the maximum level of uncertainty and vagueness 
of a given variable x^ corresponds to the width £y of its 
support (i.e., a — 0); hence, for each variable, £y is a 
useful index, which can be adopted to measure the level 
of uncertainty, once the synchronization is reached. Such an 
evolution is given by: 



£(fc) = x°(k) — x°(k) = [r®A k 



xf(0) -xf(0)' 



a£(0)-5£(0). 



(72) 



VI. Consensus and Synchronization in Critical 
Infrastructure Protection 

In this section the application of fuzzy distributed consen- 
sus and synchronization to critical infrastructure protection 
will be discussed. 

A. Consensus 

Consider a scenario composed of p highly interconnected 
infrastructures or lands, and let an operator or a team for 
each infrastructure or land be in charge to determine the 
local effects of an adverse event, such as terroristic attack, 
natural disaster or a distributed technological failure in the 
absence of a central coordination authority. 

In the following, two cases will be considered: in the 
first one the operators have to reach consensus on the actual 
severity of the failure affecting the whole scenario, on the 
base of their own partial observations; in the second case 
they have also to determine the expected evolution of the 
phenomena. 

Each expert expresses a linguistic measurement of the 
perceived severity of the failure (and of its expected growth 



Perceived ESeverity 


Description 


Value 


nothing 


the event does not induce any effect on the infrastruc- 
ture/land 





negligible 


bounded consequences that have no direct impact on 
the infrastnic Hire's or land's operativeness 


0.025 


very limited 


the event induces some geographically bounded con- 
sequences that have no direct impact on the infrastruc- 
ture's or land's operativeness 


0.05 


limited 


the event induces consequences only on subsys- 
tems/zones that have no direct impact on the infras- 
tructure's or land's operativeness 


0.1 


circumscribed degrada- 


the event induces geographically bounded conse- 


0.2 


tion 


quences 




significant degradation 


the event significantly degrades the operativeness of 
the infra stru ctu re /land 


0.30 


severe degradation 


the impact on the infrastructure/land is severe 


0.500 


quite complete stop 


the impact is quite catastrophic 


0.700 


stop 


total disruption 


1 



TABLE I 

Perceived Severity estimation table. 



ratio) affecting his/her infrastructure or land using the ex- 
pressions reported in Table 1 (and Table 2) providing, also, 
an estimate about his/her confidence on the provided data, 
in accordance with the confidence scale of Table 3. The 
values are then encoded into TFNs according to the last 
column of Tables 1, 2 and 3. Specifically, Table 1 encodes the 
actual level of failure perceived by the operator, and Table 
2 the expected growth/reduction rate (which can as well 
be negative); these numbers can be regarded as the central 
values of the TFNs, while the left and right endpoints are 
obtained by applying the confidence scale reported in Table 
3. 

Hence, being each operator aware only of its own domain, 
they need an instrument as that reported in this paper in order 
to reach a distributed consensus. 



Expected 

Growth/Reduction 


Description 


Value 


steady 


the severity of the event is expected to remain constant. 





negligible 


the severity of the event is expected to have a very 
limited growth/re duct ion. 


±0.0001 


very slow 


the severity of the event is expected to grow/reduce 
only in the long term. 


±0.001 


slow 


the severity of the event is expected to grow/reduce in 
the long term and eventually in the mid-term. 


±0.03 


quite slow 


the severity of the event is expected to grow/reduce in 
the mid-term 


±0.005 


Not so slow 


the severity of the event is expected to grow/reduce in 
the mid-term and eventually in the short term 


±0.010 


Quite Fast 


the severity of the event is expected to grow/reduce in 
the short-term 


±0.05 


Fast 


the severity of the event is expected to grow/reduce 
significantly in the short-term 


±0.07 


Very Fast 


the severity of the event is expected to grow/reduce 
dramatically in the short-term 


±0.1 



TABLE II 

Expected Growth estimation table. 



Confidence 


Description 


Value (severity) 


Value (growth) 




Perfect Knowledge (no uncertainty) 










Excellent confidence 


±0.005 


±0.0005 


* * * 


Good confidence 


±0.050 


±0.0050 




Relative Confidence 


±0.100 


±0.0100 




Uncertain 


±0.200 


±0.0200 



TABLE III 
Confidence estimation scale. 



and assume that their topology is a bipartite graph (see Figure 
[4] (a)). Such a topology may represent a scenario where some 
infrastructures are not able to communicate directly (e.g., due 
to physical ore commercial constrains) 

Assuming unitary weight the corresponding laplacian L a 

is 



L a 



2 -1 -1" 

2 -1 -1 

2 -1 -1 

-1 -1-13 

-1 -1-10 3 



(73) 



Since / * = 3, in order to respect the condition required by 
Theorem ( 5.4 1, we have that for bipartite topology = |[s] 
™ ; however for the sake of uniformity, we chose 



and -nj = |[s 

r = \[s], for both single and double integrator cases 



Let us consider a scenario composed of 5 infrastructures to communicate only 



It is immediate to recognize that, due to the choice of r, 
the dynamic matrices of both single and double integrator 
case are composed by non-negative entries. 

Table 4 shows the initial conditions for both perceived 
severity and expected growth, each with the associated 
confidence, as well as the corresponding TFN. 

Figure [5] shows the initial conditions and final synchro- 
nized state in the case of single integrators. More specifically 
in a situation where only one operator observes a very bad 
situation (i.e., operator n. 3 sees a "quite complete stop") 
while all the others have no direct perception of the crisis 
(i.e., they estimate the event ranging from "nothing" to 
"circumscribed"), they distributedly agree on a circumscribed 
degradation crisis condition with a good confidence. Hence, 
the agents are able to share vague and ambiguous information 
in a distributed way and they reach a consensus obtaining 
a consistent qualification of the actual crisis. Note that the 
consensus is obtained both in terms of expected severity 
(e.g., the central endpoint of the triangle) and in terms of 
confidence on the estimation (i.e., the width of the base of 
the triangle). 

In the case of double integrator models , Figure [8] shows 
the initial conditions for the expected growth and the con- 
sensus reached. In this case, it is more evident that even 
in the presence of very different local perception of which 
should be the evolution of the phenomena (quite all the 
operators express no overlapping estimations, both in terms 
of magnitude and sign, and two operators also with a strong 
credibility) they reach a distributed consensus or a common 
understanding of the effective growth of the evolution of 
the phenomenon, again, both in terms of magnitude and 
confidence. Note that the criticality in this latter framework is 
assumed to be growing with a constant rate, and the agents 
reach an agreement also on this varying quantity, both in 
terms of magnitude and confidence. 

Notice that the reached consensus does not depend on 
the peculiar topology adopted. Any strongly connected and 
balanced topology with the proposed protocol allows to reach 
the same consensus. For example let us consider the ring 
topology of Figure (Figure |4](b)), where each agent is able 
with its nearest neighbors. In this case 




(b) 



r©-©-©i 



<!Mf> 



Fig. 4. Topologies chosen for simulations: bipartite graph (a) and chain 
(b). All the edges have unitary weight. 



the Laplacian Lb is 



o 

-l 
l 









-1 
1 





(74) 



l[s] and T2 = Ms], Hence also in 



' 1 

4 satisfies the conditions of Theorem (|5.4i. 



and we have that r* 
this case 1 — 1 

Let us initialize both the single and double integrator 
models with the same initial conditions used for the bipartite 
topology (Table IV). 

Obviously the two topologies are not completely equiva- 
lent, because greater is the communication capability of the 
agents, faster is the consensus is reached. 

This can be immediately recognized looking at the time 
evolution of the state variables of the different agents, as 
reported in Figures [6] and [7] for the single integrator model 
with reference to the level-wise representation for a = 0.3 
(i.e., the left and right extrema). 

While in the bipartite graph topology the consensus is 
achieved after 9 iterations, with the ring topology we need 
more than 30 iterations. 

Analogously, in the case of double integrator model, 
Figures [9] and [10] report the state variables of all the agents 
for the crisis severity estimation and expected growth with 
reference to the level-wise representation for a — 0.5. 



n. 


Severity 


Confidence 


TFN 


] 


Nothing 


* 


[0,0,0] 


2 


Limited 


* * * * 


[0,0.1,0.2] 


3 


Quite Complete stop 


* * 


[0.695,0.7,0.705] 


4 


Circumscribed degradation 


* * 


[0.195,0.2,0.205] 


5 


Significant degradations 


* * * * 


[0.2,0.3,0.4] 



n. 


Expected Growth 


Growth/Reduction 


Confidence 


TFN 


1 


Steady 


Growth 


***** 


[-0.2, 0, 0.2] 


2 


Quite Fast 


Growth 


* * 


[0.0495. 0.05. 0.0505] 


3 


Slow 


Reduction 




[-0.035, -0.03, -0.025] 


4 


Very Fast 


Reduction 




[-0.105, -O.i, -0.095] 


5 


Fast 


Growth 


* 


[0.07, 0.07, 0.07] 



TABLE IV 

Initial Conditions for the case study 



Fig. 5. Initial conditions (a) and synchronized state (b) for 5 discrete time 
single integrators. The result is the same for both topologies; however the 
consensus is reached after 10 steps for bipartite topology, while for chain 
topology 32 steps are required. 



Fig. 6. Synchronization of left (a) and right (b) extrema of an a-level of 
for 5 discrete time single integrators connected by the bipartite topology, 
for a = 0.3. 



Fig. 7. Synchronization of left (a) and right (b) extrema of an a-level of 
for 5 discrete time single integrators connected by the chain topology, for 
a = 0.3. 



In order to better understand the influence of the sampling 
rate r, Figure 1 1 shows the time required for the consensus 
for a given topology (i.e., rfc*, where k* is the number of 
steps required for consensus) for r € (0, 1]. Note that such 
a time is almost constant for small values of r, while it 



Fig. 8. Initial conditions for expected growth (a) and consensus reached 
(b) for 5 discrete time double-integrators; the consensus is reached after 8 
steps for bipartite topology, and after 29 steps for chain topology. 




Fig. 9. Synchronization of an o-level of 5 discrete time double integrators 
connected by the topology of Figure R](a) for a = 0.5: left extrema of 
severity (a); right extrema of severity (b); left extrema of growth (c); right 
extrema of growth (d). 




Fig. 10. Synchronization of an a-level of 5 discrete time double integrators 
connected by the topology of Figure R](b) for a = 0.5: left extrema of 
severity (a); right extrema of severity (b); left extrema of growth (c); right 
extrema of growth (d). 



diverges for r that reaches the stability boundaries. Finally 
note that the system may reaches consensus even for values 
of r greater than r* or r|. 
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operators are very reluctant to share detailed information 
(i.e., from the field data) about their infrastructure, because 
this data is considered as sensible (that is to say, the 
disclosure of such an information would potentially have 
dramatic consequences on the safety and security of the 
infrastructures, as well as business and commercial negative 
effects). 

To overcome such a difficulty and provide the operators 
with a useful tool, in the EU project MICIE [13] we 
proposed an approach based on a distributed architecture 
that implements an online risk predictor. The risk predictor 
was implemented and tested with respect to a real case 
study composed of a power grid and a telecommunication 
infrastructure (see [13] for a more detailed discussion). 

The main idea of the MICIE system is that the control 
room of each infrastructure (3 in the proposed case study) is 
equipped with an identical copy of an abstract and high-level 
dynamic model able to capture the most relevant domino 
effects. Each model is supplied with data provided by "its" 
field (i.e., the data of the infrastructure where the tool 
is attested), and the different copies have to synchronize 
exchanging only information about their abstract state. 

Specifically, in the proposed case study, we adopted an IIM 
formulation [4], [3], as better illustrated in the following. 
Each instance of the model, attested in a given infrastruc- 
tures' control room, acquires as inputs information coming 
from its own field; in other terms the copy in the control 
room of the first infrastructure receives as inputs the severity 
of failure affecting the first infrastructure, the control room 
of second infrastructure receives as inputs those related to 
the second infrastructure, and so on. 

Allowing to synchronize the different copies, the system 
is able to provide to the different operators a coherent 
picture of the global situation, without exchanging sensible 



information. Indeed as illustrated in Figure 13 the different 
copies do not exchange their complete state; in fact they 
share a reduced and modified state vector, which depends 
on the structure of the output matrix C. As stated above, 
while it is desirable to exchange only data generated within 
the models, without disclosing field data, this generates 
nontrivial issues for the choice of the feedback matrix. A 
more feasible approach is to provide a combination of the 
two kinds of information; in this way the state exchanged is 
reduced in dimension and the sensible information is masked. 
Finally, due to the level of ambiguity and vagueness that 
characterizes such model we were forced to consider a DFS 
formulation. 



Fig. 11. Logarithmic plot of time required for consensus depending on 
the choice of r in the interval (0, 1]. The maximum theoretic limit rj* for 
bipartite topology (dotted vertical line) and r| for chain topology (solid 
vertical line) are highlighted. 



B. Synchronization 

In the field of Critical Infrastructure Protection a crucial 
aspect is the capability to identify possible risks induced 
by cascading failures. Unfortunately, critical infrastructures 



C. Input-Output Inoperability Model 

In the literature many interdependency models have been 
developed, however the Input-Output Inoperability Model 
(IIM) [4], [3] gained large attention, because of its simplicity 
and because of the ability to model cascading effects and 
indirect dependencies. In order to provide an indicator of 
the state of each infrastructure, the inoperability q is intro- 
duced, as the inability (in percentage) for an infrastructure to 
correctly operate. The IIM model for a scenario composed 



of n infrastructures is given by: 



q(k + l) =Aq(k)+Bc 
; the entires a, 



(75) 



where q,c £ E"; the entires a^- of the n x n matrix 
A represent the influence of the inoperability of j — th 
infrastructure on i — th one. The vector c represents external, 
induced inoperability (it can be seen as a perturbation 
generated by an adverse or malicious event), and its effect 
on the model is mediated by the n x n matrix B. 

Notice that, if matrix A is stable, the IIM model reaches 
an equilibrium [4], [3] q eq given by 



qeq = (In -A) 1 BC 



(76) 



such an equilibrium, represents the steady inoperability 
reached by the infrastructures after considering cascading 
effects. 

D. Simulation Results 

Consider a scenario composed of 3 critical infrastructures, 
each infrastructure equipped with the same IIM interdepen- 
dency model, described by the following matrix: 



A = 



0.1 
0.2 
0.2 



0.1 
0.1 
0.1 



0.3 
0.1 
0.2 



(77) 



Let us consider the case where the first infrastructure wants 
to estimate its state and the state of the others based 
on local information; specifically, let us assume a fuzzy 
perturbation c T = [ci,0,0] T where ci = {0.05,0.1,0.15} 
is a triangular fuzzy number and a fuzzy initial condition 
q(0) T = [ 9l (0),0,0)] T where 9l (0) = {0.05,0.1,0.15} is a 
triangular fuzzy number. 

Note that a (A) = {0.4791,-0.1,0.0209}, hence the 
matrix is stable and has non-negative entries. 

Since perturbation c is stationary, it is possible to consider 
the following extended system, treating c as state variables: 



w(k + 1) 



'q(k- 


-1)" 




'A B 


c(k-\ 






h 



w(k) = Aw(k) (78) 



Note that the above matrix is block triangular, therefore it is 
stable, since A and I are stable, and has non-negative entires. 



Hence conditions required by Theorem 3.3 are satisfied and 
the fuzzy system characterized by matrix A is stable. 

Figure [12] shows the stable evolution of crisp IIM model 
(black line) and the stable evolution of the fuzzy IIM model 
for a = (stars) and a = 0.5 (boxes), where crisp initial 
conditions and perturbations coincide with the central value 
of triangular fuzzy numbers adopted for c and q. Note 
that, since the infrastructure has only local information, 
the foreseen inoperability for the other infrastructures is 
almost zero (i.e., the model only highlights the effect of the 
inoperability of the first infrastructure on the others). 

E. Networked systems with total information sharing 

Let us now consider the case where an array of 3 fuzzy 
IIM models are interconnected in order to achieve syn- 
chronization. To this end let us suppose that each system 



S 8 g s 8 g s 



Second noperability 



Fig. 12. Evolution of crisp IIM model (black line) and evolution of the 
DFS version attested in the first infrastructure for a = (stars) and a = 0.5 
(boxes). For each a-level chosen, the evolution of both left and right extrema 
of the interval is plotted. 



only receives data coming from its field; in other words 
the «-th system receives an exogenous "disturbance" d l that 
represents the magnitude of the induced perturbation on the 
i-th infrastructure. Therefore each of the 3 systems has a 
perturbation d where 



'd 1 ' 




"0" 




"0" 





; <? = 


d 2 


; c 3 = 















d 3 



(79) 



Analogously, each of the three systems has its own initial 
condition <7*(0) where 



3 X (0) 








<z 2 (o) 





«2(o) 





q 3 (0) 






9 3 3 (0) 



(80) 

In order to achieve synchronization, there is the need to 
suitably choose the data to be exchanged among systems, 
i.e., the st ruct ure and dimension of matrix C; according to 
Theorem (5.1 1, if (C T C) is non-singular, the choice of the 



control matrix ft is extremely simplified. 

Let us first suppose that the systems share their complete 
information, i.e., yi(k) — Wi(k) and then C = li n . In this 
case it is sufficient to set ft = K with K diagonal and 
positive to achieve synchronization. 



Let us consider the topology represented in Figure 13 (the 
weights of r are reported in the figure); as a consequence, 
the resulting Laplacian matrix L is given by: 



L = 



1 -1 

-1 3 -2 
0-2 2 



(81) 



Note that l m = 1 (i.e., the minimum diagonal element 
of L); then since the minimum diagonal entry of matrix 
A is 0.1, according to theorem (5.4 1 the entries of the 
diagonal matrix K should be ku < 0.1, in order to grant 
synchronization. Therefore in this case 51 = K, with K 
diagonal and such that its diagonal entries ku = 0.03 for 




Fig. 13. In the proposed case study three systems, each equipped with 
an IIM model, are interconnected by means of weighted edges. Moreover, 
each system only receives inputs originated within its field. 



all i. 

As stated before, unfortunately, a complete information 
sharing approach, although effective, represents an unfeasible 
solution, since the operators are reluctant to completely 
disclose the infrastructure state. 

F. Networked systems with total information sharing 

To overcome the above drawback, there is the need to 
provide an output matrix C of reduced dimensions, in order 
to disclose as little information as possible. To this end, let 
us introduce the expected inoperability ratio (EIR) at time 
step k for i-th system as follows: 

EIRi(k) = (I- A)- x Ba(k) - (82) 

Recall from Eq. f76} that the equilibrium reached by the 
isolated IIM system is given by (/ — A)~ 1 Bc. Hence (82i 



represents the difference between the steady state inoper- 
ability foreseen for the i-th copy and the actual degree of 
inoperability estimated by such a IIM copy, i.e., qi{k). 

Due to its characteristics, this index provides only very 
general information, without disclosing the actual data. No- 
tice that the case EIRij(k) = represents two completely 
different situations; the case in which the j-th infrastruc- 
ture is completely working, and the case in which the 
expected equilibrium coincides with the actual inoperability. 
This ambiguity emphasizes that the EIR index alone does 
not guarantee the observability of the system. Indeed the 
corresponding n x 2n matrix C is in the form C — 
[—In (I ~ A) B], and does not satisfy the condition 
on C T C. There is therefore the need to consider also at 
least another variable to be exchanged among systems; still, 
in order to avoid disclosure of sensible data, we chose to 
let each system i exchange the average of its inoperability 
vector qi, i.e., <?j(fc) = ~ Y^j=i Qij{k)- With this choice the 
resulting (n + 1) x 2n matrix C becomes: 

In (I - A^B] 
..A Q---0 



C = 



Let H = (I — A)- 1 B\ C T C is given by 

-H T 



-H 
H T H 



(84) 



It is a standard result that if P, Q, R, S are square matrix of 
the same dimensions and P is invertible then 



det( 



det(P)det(S 



RP^Q) 



therefore 



det(C T C) = det((l+\)I n )det(^;H T H) = 2?—^det(H) 

which is nonzero, since det(H) is non zero; therefore C T C 
is nonsingular. 

The particular C matrix chosen therefore, allows syn- 
chronization without disclosing sensible information, since 
only aggregate data is shared. Note that, setting ft — KC\ 
we have that HC = K, therefore using exactly the same 
matrix K defined above, the 3 systems have exactly the same 
evolution with respect to the total information case. 

Let us now provide a simulation example. In our simu- 
lation the following values were considered for the distur- 
bances: 

d 1 = {0.05,0.1,0.15} 

d 2 = {0,0.05,0.1} (85) 

d 3 = {0.25,0.35,0.55} 

moreover, we chose to set q{(0) = {0.1,0.2,0.3}, while the 
other systems had zero initial conditions. 

As stated above, in order to reconstruct the evolution 
of the whole system, there is the need to adopt for each 
system a modified initial condition u)j(0) = 3wi(0). Note 
that the width of the resulting fuzzy number is greater than 
the initial one; this means that uncertainty increases during 
the evolution of systems, just as expected. 

In Figure [16] the synchronization of left and right extrema 
of the a-levels of qi and ci are plotted for each system in 
the case a = 0.9 and a = 0.5. 



Inoperability CI #1 Time step =1 




Input CI #1 Time step =1 



0.05 0.1 0.15 

Input CI #2 Time step =1 




0.05 

Input CI #3 Time step =1 



Fig. 14. Initial state for each state variable and each system (triangles, 
stars and boxes represent system 1, 2 and 3, respectively). 



(83) 



Inoperability CI #1 Time step =100 



1 r 



Input CI #1 Time step =100 



0.06 0.08 0.1 0.12 
Inoperability CI #2 Time step =100 



0.02 0.03 0.04 0.05 
Input CI #2 Time step =100 




Fig. 15. Final synchronized state for each state variable and system. 
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Fig. 16. Synchronization of q\ and c\ for the three systems (triangles, 
stars and boxes represent system 1, 2 and 3, respectively) with a = 0.9 
and a = 0.5. The evolution of the crisp system with the composition of 
the initial conditions and the composition of the perturbations (the central 
values of the fuzzy numbers) is also plotted with bold line. 



To conclude this Section, note that the distributed approach 
is indeed able to capture the evolution of all the infrastruc- 
tures (e.g., in the distributed approach the third infrastructure 
has a steady fuzzy inoperability whose peak value is 0.55, 
while in the isolated example of Section 6.2 the peak value 
of the third infrastructures' inoperability was about 0.025). 
This is particularly true considering the first infrastructure; 
in fact the peak value of the steady inoperability reached in 
the distributed case is 0.31 while in the isolated case is about 
0.08, since in the distributed case the actual domino effects 
are taken into account. 

VII. Conclusions 

In this paper the distributed synchronization and consensus 
problems have been extended in the fuzzy fashion, in order 
to manage uncertainty and vague information, with the aim 
to provide a distributed tool for the analysis of the state of 
critical infrastructures, when human operators and actors are 
directly involved, by means of partial state observations, as 
well as a framework for the synchronization of arrays of 
fuzzy interdependency models. 

Future work will be devoted to extend the framework, in 
order to take into account distributed systems with uncertain 



dynamics. 



Appendix 



Proof of Theorem 13.11 

It is sufficient to show that the set of triangular fuzzy 
numbers is a subset of 4'. Let a triangular fuzzy number 
P"t = {hi, Mo A*r} and consider p, q € R,p < q; let 
h — (ftp + (1 — cf))q, <j) 6 [0, 1]. First of all consider the case 
in which p < q < \i c or fi c < p < q. The value of [it (h) is 
given by: 



q-p 
f(l- 



-(h-p) + utip) 



(86) 



substituting h with <fip+ (1 — (j))q, condition (jlVb is satisfied 
as an equivalence. Consider the case in which p < fi c < 
q and fit(p) < Ht(q)- hi this case there exists a q* such 
that p < h < q* implies condition ( 17 i is satisfied as an 
equivalence, while the case q* < h < q implies condition 
( fTTj i is satisfied. A similar result holds in the case in which 
V < Me < q and Ht(p) > Ht(q), proving the statement. 
Proof of Theorem [3T2] 

First, there is the need to prove that, under the hypotheses 

V(x(0), 0) < z(0) V{x{k+l),k+l) < z(k+l); Vfc > 

(87) 

In [6], Theorem 5.2.1, it is proven that, given a scalar 
function g(r, fc) nondecreasing in r for each k > 0, k £ N + 
and given two sequences of real numbers {ck},{dk} such 
that Co < do an d sucn that the following inequality holds for 
all k > 



Cfe+i < g[ck, k) 
dk+i > g{dk,k) 



(88) 
(89) 



then Cfc < dk, for all fc > 0. 

Such a Theorem trivially extends to the vectorial case, 



therefore, considering a vectorial G(r, k) 



N+ 



and setting {c^} as the sequence of defuzzyfied values 
{V(x(k), fc)} and {d^} equal to the sequence of values 



assumed by system (20i {z(fc)}, implication (88 1 holds 
becuse of implication ( |23| l and implication ( 89 1 is true due 
to the monotonicity of G(-, •); therefore implication (87i is 
proved. 



Suppose that the trivial solution of (21 1 is stable. Then, 
for each a(e) > there exists a positive Si(e) such that 



<M*(o),Oiv] = £li*i(o)<:*i(e) 



d RN [z{k + 1), Oat] = J2?=i Zj (k + l)< a{e) 



(90) 



where <i R «[-, •] is the distance in 



pJV 



To prove the stability of Sytem (20 1 there is the need to 



show that, for any e > there exists a positive 8(e) such 
that if (igiv [ir(0), 0] < 8(e) then (i E N [a;(fc), 0] < e, for each 
k > 0. 

Since z(0) = V(x(0),0), on the base of the Implication 



d87b, it follows that V (x(k + 1), k + 1) < Y,f=i z ( k + 1); 



therefore, according to Inequality (24i 



a(d EN [x(k+l),0]) < V (x(k + l),k+l) < 



<EL^(fc + i)<«(e) 



(91) 



Due to the continuity and monotonicity of et(-), it follows 
that 

a(d E N [x(k + 1), 6]) < <z(e) => d E N [x(k + 1), 6] < e (92) 

and the stability of system ( |20] > is proved. 
For asymptotic stability note that 

< a{d m [x{k + 1),0]) < Vb(a;(fe + l),fc + l) < 

iV 

<^z,(fc + l) 



If System (21 1 is asymptotically stable, then Zj(k + 1) — > 
as fc — > oo, for each j = 1, . . . , to, and it follows that 

d E N [x(k + 1), 0] —> as fc — > oo, too. 



Proof of Corollary 3.3 



It will be shown that, choosing Vi(x(/c),fc) = d E (xi(k),6i) 
the conditions required by Theorem |3.2| are verified. 



Inequality (24i is satisfied if it is true component- wise, 
that is, if: 

n 

a(«Ma?(fc),6)) < 5^du(aJi(*),6i) =«fe»(x(fc),6) (93) 

i=l 

Since g^™ 0) > 0, the inequality is verified choosing 

a(r) — ipr, with ip £ [0,1]. In this case a(-) is continuous 
and monotone non-decreasing. It remains to prove inequality 

423). 

Note that 

V(a;(&),*) = [d E (x 1 (fc),6i),...,d E (x„(fc),6„)] T 
There is the need to prove that, for all i = 1, . . . , n 

dz{fi(x{k),k),6i) < fi(V(x(k), k),k) (94) 
Note that [6;] a = {0} for all a, hence: 

d E (w,6 l ) = sup a>0 {p dlltS >([w] a ,{0})} = 



max{d R ([w]°, {0})} = max{||z|| : z £ [w] } 



(95) 



that is to say that the distance of a given fuzzy set is the 
maximum value of the norm of its support (i.e., the absolute 
value of one of the endpoints of the support). Analogously 
we have that 



Vi{x{k),k) 



\z\\:z£[ Xi (k)}°} 



(96) 



Note that fi(-,k) is monotone nondecreasing and that in 
the left term of inequality ( |9"4"| i the max{|| • ||} are taken 
component- wise; therefore inequality (|94b is always verified. 



Hence the requirements of Theorem 3.2 are fulfilled and 
the proof is complete. 
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